Secure Your Online Store

More and more stores are moving online. Whether that was part of your plan or something that you’ve recently decided to do, it’s important to make sure that you protect your customers’ data. That means you need to take steps to secure your online store. In this article, we want to focus on giving you some suggestions for the most effective ways you can improve your security with the least amount of effort.

We know that small business owners have a lot of different roles, and that these roles are changing. You’re responsible for keeping the sales flowing, marketing, dealing with customers and clients, staff, finances, the list of responsibilities never ends. With this in mind, you may not have the skill or time to look after the security of your website or maybe you just aren’t sure where to start.

Ultimately, you are responsible for making sure that your website is secure even if you use other people to help you look after it. And the last thing you want is to find your website has been hacked and your customer data stolen.

So whether you look after your site yourself or you outsource it to someone else, we’ve written this article to help you minimise the risk of a breach and help you start the conversation about security with your website provider.

Who is This Article For and What Does it Cover?

If someone else looks after your site and you aren’t very technical, you might want to jump down to our list of questions you can ask your provider.

If you want to read more about what steps we recommend to secure your website, keep reading on or jump to the topic that interests you the most.

• Patching and why you need to patch everything
• Securing your login
  • Use Multi-Factor Authentication (MFA)
  • Change the default URL
  • Whitelist your IP address
  • Monitor access logs
• More steps you can take to protect your security
  • Add a Web Application Firewall (WAF)
  • Secure your Transport Layer Security (TLS)
  • Secure and disable things you don’t need
  • Monitor critical files
  • Run vulnerability scans
• What to ask your service provider
• Do you have to do everything on this list?
• Next steps

This article is not meant to be exhaustive and cover everything that you need to do, but it is a starting point for understanding some of the key steps you can take to minimise your risks if you’re hosting your own web store or using open source shopping solutions.

Patch Everything

Difficulty: Easy to Hard

This means:

• Patch your host (the server that your web store runs on)
• Patch your application (the application you are using for your website, like Magento or WordPress)
• Patch your plugins
• Patch your themes

If you aren’t patching all of these things then you might not be aware of all of the potential vulnerabilities in your environment. And if there are things in your environment that you can’t patch (for example, your application), then you should be looking to see if you are missing some patches for your host’s operating system or one of the underlying dependencies like php. Very often the reason you can’t patch one thing is because you haven’t yet patched another. That’s why patching everything is so important!

Patching your plugins might be easy, but if you don’t have access to the host or you’re not familiar with how to update your server and what needs updating, this might be a bit harder.

Secure Your Login

We all know that long, strong passwords are best. And PCI says that you should make sure that they are complex, regularly changed, and have lockouts and password policies. But before you even get to that, the most effective thing that you can do is put multi-factor authentication everywhere that you sign in.

Multi-Factor Authentication (MFA)

Difficulty: Easy

Most web applications (including WordPress and Magento) have plugins that can be used to configure multi-factor authentication. You’ve probably had to use multi-factor authentication before, maybe with your email, maybe at work, maybe for your bank. Examples of multi-factor authentication (MFA) include:

• SMS notifications
• Entering a code from an application on your phone
• Confirming a push notification on your phone
• Confirming a login with a phone call

Making sure that anyone who has access to the host or the admin part of the application uses MFA is one of the most effective tools you can use to prevent someone from guessing your password or using a password that has been compromised (want to see if your password may have been compromised? Check have I been pwned?). By using a one-time limited time token, you add another factor that makes it much harder for someone to get access to your account. Will it take a little longer to login? Yes. But the security that it adds is worth it!

Most shopping and web applications support plugins for multi-factor authentication. We recommend finding one that supports multiple users so that if you have more than one person with access, everyone is able to configure it for themselves.

Note: You don’t have to make your customers use MFA. This recommendation only applies to people who have access to change the configuration of the website.

Change the Login URL

Difficulty: Easy

One of the most basic things an attacker will do is try to login from the default login page. It’s usually a quick and easy process to do. Most applications let you either change it as part of the basic configuration options or you can add a plugin to change the login URL.

Bonus Tip: Lock down access to your login page to just your static IP address by configuring it on your firewall. This way even if someone does stumble on your login page, they won’t be able to use it.

Whitelist Your (Static) IP Address

Difficulty: Medium

The next most effective thing you can do (once you’ve added multi-factor authentication) is to whitelist certain connections to only your IP address (if you have a static IP address). For example, if you want to be able to connect to your server via SSH, restrict it to your IP address and the web interface.

Restricting access to authentication methods or sensitive areas of the website is a good way to prevent other people from accessing it. However, make sure that if you restrict access to a single IP address, you always have access to it or you might end up locking yourself out.

Monitor Logs

Difficulty: Medium

One of the key things you can do is regularly check to make sure that new accounts aren’t being added and that accounts are only being logged into by the right people.

So for example, if you know you only ever login between 10am-3pm and suddenly there’s a login at 2am, then this should raise some red flags for you.

Things that you should look for in the logs include:

• Logins
• Uploads of files
• Changes to configurations

We know that sometimes knowing what to look for is half the battle. And knowing what is normal and what is not normal can also be hard when you first start looking at the logs. Regularly looking at the logs you will probably start to see patterns. We recommend that you keep logs for at least 12 months just in case you need to go back and find out when something happened.

Add Security Controls

Here’s where things can get a little more challenging. You can go as in-depth as you want depending on your skill. We will provide some recommendations for things you can do at different levels of difficulty.

Add a Web Application Firewall (WAF)

Difficulty: Easy to Medium

A web application firewall can be used to mitigate the risk of vulnerabilities in the application that might be exploited. For example, it can help protect against cross-site scripting or injection vulnerabilities.

There are lots of different options out there for web application firewalls.

The easiest option is to use a fully managed Web Application Firewall (for example, CloudFlare, Akamai, CloudFront and Stackpath are just some of the options out there). These services charge a monthly fee, but they look after the the detail of how they protect your web application.

You can also install plugins that provide an application layer web application firewall. These usually have a bit more configuration to them and you should understand what you might break by enabling them. These can be added on the host or to the application.

The important thing is to make sure that you’ve configured things to block potential attacks. Make sure you’re regularly checking that you aren’t blocking legitimate traffic as well.

Configure Transport Security Layer (TLS)

Difficulty: Easy to Medium

The default standard for web pages is to ensure that they are encrypted. Browsers and search engines expect that you will use TLS. And browsers now warn if the website is using a version of TLS that is considered as insecure.

Some WAF / CDN (content delivery network) solutions let you configure what versions of TLS you use from their web interface. If you can do that from your WAF / CDN, this is pretty easy. We recommend setting it to accept TLSv1.2 and higher.

But if you aren’t using a WAF / CDN or it doesn’t have that option, you might need to figure out how to configure TLS on your web host yourself.

Disable (or Secure) Anything You Don’t Need

Difficulty: Easy to Hard

This can apply to a number of different areas in your web store. This advice most often applies to:

• Application plugins / themes
• Open ports
• OS features

Some of these are easier than others.

The easiest part is disabling / removing plugins that you don’t need in the application. Regardless of what application you use, it probably supports plugins. Maybe you’ve tried some but no longer use them, maybe some of them came with the application by default. By disabling / removing any of the plugins you don’t need, you have fewer potential vulnerabilities and fewer things to patch. Removing these is usually a few clicks in the application.

A little bit more difficult might be disabling open ports that you don’t need. For example, if you don’t regularly use FTP to upload files, then make sure you disable it when it is not in use. To do this, you will need to be able to access a firewall or the host operating system. There are too many possibilities to list here for how you would do it. And we know that different people will have different approaches. But a few recommendations that might help are:

• Allow access on port 443
• Redirect traffic from port 80 to port 443
• Restrict access via RDP or SSH to your static IP address
• Disable FTP except when you need it

The area that is probably the most challenging is disabling things in the operating system that you don’t need. To be able to do this, you need to understand what is necessary and what you might break by removing things. We only recommend this if you are very familiar with how to secure an operating system. More importantly, make sure that you patch everything!

Monitor Critical Files

Difficulty: Medium

There are certain files that should be monitored for changes. Exactly which files should be monitored will depend on what application you are using.

You can monitor these files using programs on the web server itself, or some plugins will help you lock down access to certain files or monitor for changes.

The important thing to be able to tell is if someone has added something to your site (like malicious code) which could cause a security breach.

Vulnerability Scans

Difficulty: Medium to Hard

Vulnerability scans are a type of scan that is different from antivirus scans. They aren’t looking for malware, they are looking for misconfigurations in your environment (for example, insecure versions of TLS, open ports, some insecure software).

To make them effective, you have to be able to understand what it is that they are saying. So you might need some help if your expertise isn’t in this area. The other thing you have to do is understand how to fix the things that are identified. Identifying a vulnerability without doing anything about it doesn’t change the risk.

These kinds of scans can be useful, but they are one of the more advanced recommendations in this post since they require a level of technical expertise.

What to Ask

Even if you don’t understand some of the terminology in this article, we’ve put together a table of questions that you can ask the people who look after your website (if you don’t look after it yourself). While you should probably be asking more questions than this, you can use these as a starting point.

If you find that most or all of these recommendations haven’t been implemented, it’s probably a good time to find out if they are things that your provider can do for you and start the discussion about security.

Do I Have to Do Everything in the List?

No, you probably don’t have to do everything. But the more you can do, the more you minimise the risk of a compromise.

Depending on how you take payments you will probably have to do some of these things, but even if your bank hasn’t requested you to be PCI compliant, we recommend looking at the steps you can take with a focus on protecting your customers.

What Next?

If you’re a merchant, you might want to read more about some of our PCI basics, including:

• Where it says you need to be PCI compliant
• What your reporting requirements are
• More PCI basics for merchants

If you aren’t sure about how your online store has been secured, Confide can help. We have packages for small businesses and can do security reviews of your web site to identify improvements you can make.